Versions of the package network before 0.7.0 are vulnerable to...
Vulnerability Description
Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-21488
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- NodeMedic-FINE
References
- https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-11426552
- https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c
- https://github.com/tomas/network/commit/72c523265940fe279eb0050d441522628f8988e5
- https://github.com/tomas/network/commit/6ec8713580938ab4666df2f2d0f3399891ed2ad7
- https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7
